A buffer overflow exists in the HTTPS login interface of Hirschmann HiSecOS devices when RADIUS authentication is used. The flaw arises when a password longer than 128 characters is submitted, overwhelming a fixed‑size buffer. An attacker can exploit this to crash the device or potentially execute arbitrary code, resulting in a denial of service or full compromise of the system. The weakness is a classic buffer overflow (CWE‑120).

The vulnerability affects Hirschmann HiSecOS Classic Firewalls, including the EAGLE and EAGLE One variants, on all firmware releases prior to 05.3.03. Users of these devices should identify whether their firewall software predates that version and hence is susceptible.

The CVSS score of 9.3 labels this issue as critical. Although an EPSS score is not provided, the high severity and the remote nature of the attack suggest a reasonable likelihood of exploitation. It is not listed in the CISA KEV catalog, but it remains a high‑risk vulnerability because attackers can trigger it simply by attempting a login via HTTPS. The most probable attack vector is a remote attacker sending a login request with an excessively long password over an HTTPS session while RADIUS authentication is enabled.